neshta | e16a2702915c668a0db075ee166a1af76571b6757d1b1721cf0a407e3b96b741

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
Size 5.1MB
Sample260701-cem32ses3s
SHA256 e16a2702915c668a0db075ee166a1af76571b6757d1b1721cf0a407e3b96b741
MD5 fadbeca908fa2ffbd3e49ee0cc5a4809
SHA1 3a4fa66a1f24b312a0c6d327b882d6c472b76953
SHA512 fb32ff331c06c8bee24a1db4e43f7d429b84854d1598ea05d4f950cfd0df913ba308f1b2e3e3d522ffc576dfe832ebc6ec011da3b3355632d6f9c9c50086d05d
SSDEEP 49152:I7EY75Vhj9As9UVrdxGD9KKqZDTltew1fqeNTwanpSkU0ZfbZa2jVQMRVrJzVoLZ:474YKRrS4hRQI6Jy4XhvF
TLSH
T163466D03F2EA41D8E0BAD6758BA68232E976BC454B34A2DF075036191E75FE49F3C712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neshta persistence spyware stealer

Malware Config

Signatures

Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5988 created 3128	5988	identity_helper.exe	47

Executes dropped EXE 11 IoCs

pid	Process
764	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
3316	identity_helper.exe
5988	identity_helper.exe
1184	svchost.com
2400	IDENTI~1.EXE
1976	setup.exe
4300	svchost.com
2924	setup.exe
2400	setup.exe
4644	setup.exe
1032	setup.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\BHO\ie_to_edge_stub.exe	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\INSTAL~1\setup.exe	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MI391D~1.EXE	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~2.EXE	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\Google\GOOGLE~1\141073~1.0\DISABL~1.EXE	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MI9C33~1.EXE	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\identity_helper.exe	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\30ef0e96-de6c-4d8d-9aaa-d7d033297cf6.tmp	setup.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~3.EXE	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MID1AD~1.EXE	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_proxy.exe	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MIA062~1.EXE	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\MpCmdRun.exe	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{5625B~1\WINDOW~1.EXE	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\pwahelper.exe	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedgewebview2.exe	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\notification_helper.exe	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge.exe	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_click_helper.exe	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~2.EXE	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge.exe	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~1.EXE	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\2110e518-d795-48c0-9077-b32ad77d1bbd.tmp	setup.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe

Drops file in Windows directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping904_271085458\protocols.json	msedge.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping904_857423457\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\svchost.com	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
File opened for modification	C:\Windows\directx.sys	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping904_1931667127\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping904_1931667127\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping904_857423457\office_endpoints_list.json	msedge.exe
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\svchost.com	svchost.com
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping904_857423457\llm_user_input_extractor_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\svchost.com	identity_helper.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping904_857423457\manifest.json	msedge.exe
File opened for modification	C:\Windows\svchost.com	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping904_1773918951\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping904_271085458\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	identity_helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5552	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273448101023233"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings	identity_helper.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{501A129A-3D1F-49D6-BF2B-101437F17263}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings	setup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1332	msedge.exe
1332	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
904	msedge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 5892 wrote to memory of 764	5892	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe	88
PID 764 wrote to memory of 904	764	2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe	89
PID 904 wrote to memory of 4156	904	msedge.exe	90
PID 904 wrote to memory of 5408	904	msedge.exe	91
PID 904 wrote to memory of 5552	904	msedge.exe	92
PID 904 wrote to memory of 5408	904	msedge.exe	91
PID 904 wrote to memory of 5408	904	msedge.exe	91
PID 904 wrote to memory of 5004	904	msedge.exe	93
PID 904 wrote to memory of 5004	904	msedge.exe	93
PID 904 wrote to memory of 760	904	msedge.exe	95
PID 904 wrote to memory of 760	904	msedge.exe	95
PID 904 wrote to memory of 760	904	msedge.exe	95
PID 904 wrote to memory of 1192	904	msedge.exe	96
PID 904 wrote to memory of 1192	904	msedge.exe	96
PID 904 wrote to memory of 1192	904	msedge.exe	96
PID 904 wrote to memory of 3324	904	msedge.exe	97
PID 904 wrote to memory of 5264	904	msedge.exe	98
PID 904 wrote to memory of 1016	904	msedge.exe	99
PID 904 wrote to memory of 2524	904	msedge.exe	100
PID 904 wrote to memory of 704	904	msedge.exe	101
PID 904 wrote to memory of 2524	904	msedge.exe	100
PID 904 wrote to memory of 2524	904	msedge.exe	100
PID 904 wrote to memory of 704	904	msedge.exe	101
PID 904 wrote to memory of 704	904	msedge.exe	101
PID 904 wrote to memory of 3228	904	msedge.exe	102
PID 904 wrote to memory of 3228	904	msedge.exe	102
PID 904 wrote to memory of 5808	904	msedge.exe	104
PID 904 wrote to memory of 5808	904	msedge.exe	104
PID 904 wrote to memory of 2796	904	msedge.exe	105
PID 904 wrote to memory of 2796	904	msedge.exe	105
PID 904 wrote to memory of 5988	904	msedge.exe	107
PID 5988 wrote to memory of 1184	5988	identity_helper.exe	108
PID 1184 wrote to memory of 2400	1184	svchost.com	109
PID 904 wrote to memory of 3296	904	msedge.exe	112
PID 904 wrote to memory of 3296	904	msedge.exe	112
PID 904 wrote to memory of 1976	904	msedge.exe	114
PID 1976 wrote to memory of 4300	1976	setup.exe	115
PID 4300 wrote to memory of 2924	4300	svchost.com	116
PID 2924 wrote to memory of 2400	2924	setup.exe	117
PID 2924 wrote to memory of 4644	2924	setup.exe	118
PID 4644 wrote to memory of 1032	4644	setup.exe	119
PID 904 wrote to memory of 5776	904	msedge.exe	121
PID 904 wrote to memory of 5776	904	msedge.exe	121
PID 904 wrote to memory of 3316	904	msedge.exe	122
PID 904 wrote to memory of 3316	904	msedge.exe	122
PID 904 wrote to memory of 5020	904	msedge.exe	126
PID 904 wrote to memory of 5020	904	msedge.exe	126
PID 904 wrote to memory of 1788	904	msedge.exe	127
PID 904 wrote to memory of 1788	904	msedge.exe	127
PID 904 wrote to memory of 2672	904	msedge.exe	128
PID 904 wrote to memory of 2672	904	msedge.exe	128
PID 904 wrote to memory of 1332	904	msedge.exe	129
PID 904 wrote to memory of 5556	904	msedge.exe	130
PID 904 wrote to memory of 5556	904	msedge.exe	130

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3128
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\IDENTI~1.EXE" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,100421503288617759,9233640695997005609,524288 --field-trial-handle=2552,i,5089770870325314908,161932369671002674,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Users\Admin\AppData\Local\Temp\3582-490\IDENTI~1.EXE
    C:\Users\Admin\AppData\Local\Temp\3582-490\IDENTI~1.EXE --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,100421503288617759,9233640695997005609,524288 --field-trial-handle=2552,i,5089770870325314908,161932369671002674,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
    3⤵
    - Executes dropped EXE
    PID:2400

C:\Users\Admin\AppData\Local\Temp\2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe"
1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5892
- C:\Users\Admin\AppData\Local\Temp\3582-490\2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --force-first-run
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x140,0x2d8,0x7ffb0b7cc188,0x7ffb0b7cc194,0x7ffb0b7cc1a0
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,12201308474141703784,258900863849523610,262144 --field-trial-handle=2552,i,5089770870325314908,161932369671002674,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:2
      4⤵
      PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,6389970747838835574,379333918777377689,524288 --field-trial-handle=2552,i,5089770870325314908,161932369671002674,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:11
      4⤵
      System Time Discovery
      PID:5552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2200,i,5344467502387414221,10702670314168008549,524288 --field-trial-handle=2552,i,5089770870325314908,161932369671002674,262144 --variations-seed-version --mojo-platform-channel-handle=316 /prefetch:13
      4⤵
      PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,10377233045201602166,14034168365066589652,2097152 --field-trial-handle=2552,i,5089770870325314908,161932369671002674,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,8263413724951014670,17553739370276957253,2097152 --field-trial-handle=2552,i,5089770870325314908,161932369671002674,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:1192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,13050415450231363704,15803297567788967570,524288 --field-trial-handle=2552,i,5089770870325314908,161932369671002674,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:14
      4⤵
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,649043775376013874,15584335807988067234,524288 --field-trial-handle=2552,i,5089770870325314908,161932369671002674,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
      4⤵
      PID:5264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,3807467758274081272,16685920731198170487,524288 --field-trial-handle=2552,i,5089770870325314908,161932369671002674,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
      4⤵
      PID:1016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4328,i,1153869293316368642,17578056574392131250,2097152 --field-trial-handle=2552,i,5089770870325314908,161932369671002674,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
      4⤵
      PID:2524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4352,i,5876321827104836641,16587069380205036758,2097152 --field-trial-handle=2552,i,5089770870325314908,161932369671002674,262144 --variations-seed-version --mojo-platform-channel-handle=1616 /prefetch:9
      4⤵
      PID:704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3888,i,8987016075934249661,3310320190319452543,524288 --field-trial-handle=2552,i,5089770870325314908,161932369671002674,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:14
      4⤵
      PID:3228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,14618524364941507357,15347456518226949427,524288 --field-trial-handle=2552,i,5089770870325314908,161932369671002674,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
      4⤵
      PID:5808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,3480532654180725001,18126098225581184739,524288 --field-trial-handle=2552,i,5089770870325314908,161932369671002674,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
      4⤵
      PID:2796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,100421503288617759,9233640695997005609,524288 --field-trial-handle=2552,i,5089770870325314908,161932369671002674,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
      4⤵
      Executes dropped EXE
      PID:3316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,100421503288617759,9233640695997005609,524288 --field-trial-handle=2552,i,5089770870325314908,161932369671002674,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:5988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,1152737860663032885,2928540830523195872,524288 --field-trial-handle=2552,i,5089770870325314908,161932369671002674,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
      4⤵
      PID:3296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1976
    - - C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 --annotation=exe=C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff67cd804c8,0x7ff67cd804d4,0x7ff67cd804e0
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 --annotation=exe=C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x7ff67cd804c8,0x7ff67cd804d4,0x7ff67cd804e0
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,952634890547250950,6705311755428740080,524288 --field-trial-handle=2552,i,5089770870325314908,161932369671002674,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
      4⤵
      PID:5776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,5800526622416482091,14659938706981080545,524288 --field-trial-handle=2552,i,5089770870325314908,161932369671002674,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
      4⤵
      PID:3316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,16745167103130142975,6202808493656015155,524288 --field-trial-handle=2552,i,5089770870325314908,161932369671002674,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
      4⤵
      PID:5020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=828,i,6223523392305568627,1350936372163446647,524288 --field-trial-handle=2552,i,5089770870325314908,161932369671002674,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
      4⤵
      PID:1788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3908,i,10996219032894523531,17956913047281104027,524288 --field-trial-handle=2552,i,5089770870325314908,161932369671002674,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
      4⤵
      PID:2672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3908,i,8933170027656997792,9918777138460521021,262144 --field-trial-handle=2552,i,5089770870325314908,161932369671002674,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,6951437063169982527,9806425865028926768,524288 --field-trial-handle=2552,i,5089770870325314908,161932369671002674,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:14
      4⤵
      PID:5556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ACROBR~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
Size 328KB
SHA256 a5f47d59b8d08fc85ee411ec2e1015fedda08fd4a6cae2bf7b3bb1a7db2ccb5e
MD5 114445130d5e083c42830d9adbf5d748
SHA1 48a62ec52b835918cc19a2df9c624a7a0d6b85e1
SHA512 45eb73fd4e12ed70c386c733b2bc04296fb1a16be04b4cd45260c70d0e4b6cf3a87dc223ce2319d94b79c513ba19d0816bae428c466076c1de906429aaa78748
SSDEEP 6144:Pu76edjvw6L6jAVnhH1Am2ZBU4M528hW8Bi7Q5VYN9:c6exwI1oB8RZ4Q5VYH
TLSH
T11F645B017F908EB6F5A2807F5D7A631D566ABA221B10E2C373703B5DCD321C59A3E366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ACROTE~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
Size 86KB
SHA256 a46d1ffbe9114015050b2a778859c26248f8bab22d5d1a302b59373bc20c6b45
MD5 ef63e5ccbea2788d900f1c70a6159c68
SHA1 4ac2e144f9dd97a0cd061b76be89f7850887c166
SHA512 913371abb54e0adc94aa08372a20f07ced9f9fdc170f9e468cd39c7387c7e30c1ae238148ccf355d5c8b88b7fd63f914bb108c6cafca9a791d02d8b36468bfac
SSDEEP 1536:yxqjQ+P04wsZLnDrCvgh/sE/EkHd0Ci2zkQASqk+H6L2C:zr8WDrCEsEM6GC+QA8+HlC
TLSH
T13B93AD13FAF18872D1221BF89C29E359C93F7A305E3056A7A3E40D9D5E757C26C2924B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADOBEC~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
Size 5.7MB
SHA256 1ebe469c94c2c2a5acbc3927cef19dbe2f583ba3651a55623633891c4c05cc22
MD5 3e4c1ecf89d19b8484e386008bb37a25
SHA1 a9a92b63645928e8a92dc395713d3c5b921026b7
SHA512 473d03abbb61609749a176a0724e427599a4f4707d72a74ed457b2198098f59fdf64b5394798db82f4064dfe964083d70af6a50a5fa2ab2674c77a99792e4e52
SSDEEP 49152:jmlI9H9rY654KYroYJqkhWFUBlNwnFq3kXRsPI6BRY20YZAliDgFL2YmXZjU2P38:IiH9MfT3NwMkKhBRr0yAk6qkKvq
TLSH
T1ED567C22B902C139E15102B159ECBFE9C49D99348FB105DBBAC41F7E9A613E33931E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADelRCP.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
Size 175KB
SHA256 1ad4c736829dbcb0fcc620fd897fe0941b9c01e14ccba5d18085b3ca0416ab66
MD5 3da833f022988fbc093129595cc8591c
SHA1 fdde5a7fb7a60169d2967ff88c6aba8273f12e36
SHA512 1299d63337c958e8072d6aaa057904cbbaa51c2eec4457269ead6b72c4eb2a10882e4a5dc7afcdcab5a6910d2105c2e5ee706850074e0425ae7f87d9ea1e5537
SSDEEP 3072:zr8WDrClHb5CZCq5DACsVlNl7HIJ1PcJ7LxnkdA53Pa4sjSTX4:Pul4N5QVrZZ7Lxkmsjj
TLSH
T1BD045C12BBC09075E69313723EFC79E44BF6BC329EA510ABF318495A197F250963931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrCEF.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
Size 9.4MB
SHA256 3e815d583236b9cecd912fcc949a301d1e51b609cbb53a2285d08feea305edcd
MD5 124147ede15f97b47224628152110ce2
SHA1 4530fee9b1199777693073414b82420a7c88a042
SHA512 f4c2825380d1bb9ca889d5c5684f13aa0cacb0d6511f6409ca0972a7191195a0175e00c995407848bf09ea03cff05c7395952bf2ffd2af2015b8939f75a8e627
SSDEEP 98304:FrbT5JhEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZTA:lXnfW/JLGMcblLheTA
TLSH
T128A6AF1D7BE21036CD732176AF4FA104E739D007A215C6977ADC83981FB1AA152B6FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
Size 2.4MB
SHA256 bd7696911d75a9a35dfd125b24cb95003f1e9598592df47fa23a2568986a4a9a
MD5 d9e8a1fa55faebd36ed2342fedefbedd
SHA1 c25cc7f0035488de9c5df0121a09b5100e1c28e9
SHA512 134644c68bd04536e9ea0a5da6e334d36b1ce8012a061fa6dabd31f85c16a1ac9eee8c40fee3d55f25c4d4edf0672de8ce204e344c800361cbcff092c09d7a33
SSDEEP 49152:4TfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJX:4TfiG/nzU90T
TLSH
T153C59226A2C8C0EBE5642170CC59BBF900546D78DBA2CDD7BD447E16BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WCCHRO~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
Size 183KB
SHA256 8ca27077312716f79f39309156c905719a908e8ded4bf88c2ba6fa821e574673
MD5 4ab023aa6def7b300dec4fc7ef55dbe7
SHA1 aa30491eb799fa5bdf79691f8fe5e087467463f1
SHA512 000e33cc2399efa9dc56c06a42f91eb64b94f30b78cf260469f45f3b876f518d2d2b62e33d8f697660ae560d595e5bd5b7a5f847c316d5f97adeb3d8f9248ab5
SSDEEP 3072:zr8WDrCU8AIsfHwCbf9MFdRvyAgnz8n/dfQ7PjFKq23T/h:PuQbfHwCbyFdAafCPc53T/h
TLSH
T112046B51F7C7C9B2E05206704C2AAF6541B9FE381F7105EBF3E87A1E5A713C2182666B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eula.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
Size 131KB
SHA256 49091e1e41980b39d8de055fe6c6a1dc69398f17817960d64743e7efb740efc4
MD5 514972e16cdda8b53012ad8a14a26e60
SHA1 aa082c2fbe0b3dd5c47952f9a285636412203559
SHA512 98bbd6f06e3ff3e94aee3620f20f89e254dde157bc8129a64cf78fefe5cf9b13c7902128c2acbd54b3def527e09a039bd1f66ba64efb85f3f0404d894cabbee4
SSDEEP 3072:zr8WDrCYq9YnyoRmLisiselSsONt3F7oQGO7M1bp:PuGgLHvld2
TLSH
T12FD37C13BBE1C872C66207789D25F36696AFF6305E74CB6777880B0F8DB46824D0C65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FULLTR~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
Size 254KB
SHA256 129a2bfe25ceabb871b65b645ef98f6799d7d273fc5ddfd33c1cb78f5b76fa3b
MD5 c4a918069757a263adb9fbc9f5c9e00d
SHA1 66d749fc566763b6170080a40f54f4cda4644af4
SHA512 4ecf32fa2c8f53ff7a08555ec5d37739dc1358352621d038669f608edf18b0dcc6dca168a2b602359c9ee098052e546e5c02603f83aad44a114192138de7b7b9
SSDEEP 3072:zr8WDrC2l4dsOc6v2vTzwU+Pho86meq+FaSoB2+vSHr8qcVz5fzsC:Pul3PiY+Fa7BdvG1cT7
TLSH
T1B6445A307B86C53BE66301718CF8EBBF942EBA150F6951D7B3984B5E5EA05C32E31846
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOGTRA~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
Size 386KB
SHA256 cae320401aa01a3cef836c191c2edbd7a96bfcce9efad1a21880626a64cc4dec
MD5 2e989da204d9c4c3e375a32edf4d16e7
SHA1 e8a0bf8b4ae4f26e2af5c1748de6055ba4308129
SHA512 3ebf71578bef909d9411c131d0ccd38ead68cba01a8e0f845d08faa012ca2136476fe09a2859ed846641f80b7a2d9b78d49c709065a52c6b9ee149edf84c8c4f
SSDEEP 6144:Pu83n0dK2NP0RHx8D98WTBPW8fF8oABm1nKZ0RsrI:CKhHSDeWTRW8fdebmqI
TLSH
T17784AE11FB86C172D96602728DAAA35CC4BDB5714F314BD3E3DC6F0D9E601D2A932B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

READER~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
Size 92KB
SHA256 7a8ee09f8a75b3e812f99a0b611c6720626c62c6985306a408694389a996c8e9
MD5 3e8712e3f8ce04d61b1c23d9494e1154
SHA1 7e28cd92992cdee55a02b5ece4b7c2fc4dd0c5e4
SHA512 d07d924f338bd36ca51c8e11931f7ff069e65942725a8e1f1ff6b81076a987ab7d787452a5fb08314edf1489e081f4164db1ad299a6d78401e630796f4487dc8
SSDEEP 1536:yxqjQ+P04wsZLnDrCU6w8MghW4wNlu9HQIXsW/44:zr8WDrCU6w8oFlKwW//
TLSH
T120936C13BB82CE73D4214AB91C6997B8D4BAF5306F2557E367640A4A8DBC3C12C3925F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WOW_HE~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE
Size 147KB
SHA256 686bec325444e43232fb20e96365bb1f1eb7c47a4e4ce246fc900d3a9784d436
MD5 dc6f9d4b474492fd2c6bb0d6219b9877
SHA1 85f5550b7e51ecbf361aaba35b26d62ed4a3f907
SHA512 1e9c2dfeada91e69ee91cd398145e4044bd5788a628b89441c8c6ff4067ba0a399124197fd31dad26ccb76a4d866ad99918ba8e1549983be967d31b933ad9780
SSDEEP 3072:zr8WDrCM6l8TRpR+EMucyaGoS43IIJNdS3UA:PuM6l8aGo/3VL4kA
TLSH
T102E38C57B7E134F8E1768A79CC615608EB32B8352A319BEF03A4065A5F273C05D3DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arh.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
Size 125KB
SHA256 9a7391267ab83b45a47d9fcf1e0f76002ed6640ed6a574ba51373410b94812f6
MD5 66a77a65eea771304e524dd844c9846a
SHA1 f7e3b403439b5f63927e8681a64f62caafe9a360
SHA512 3643ad1036075305d76dfd753b1ed29ae611b4b9f397b2520f95b1487e85155a111adc83578db8ca5d0fd1e9fe146d018e22f572c187ef468eab8d11d48fc7f4
SSDEEP 3072:zr8WDrCkQw/STyr5Jks7MvrMzkm8PL3Eo:PukQPQLrzkmIL3Eo
TLSH
T110C3AE62B6A1C432D4924D78891DC3B18E3F7D316AA99957F7E80B5E8E607C0D61E30F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BITM~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
Size 142KB
SHA256 a89d3e2109a8e35e263da363d3551258ea320a99bfb84a4b13ad563008eda8d9
MD5 3ccfc6967bcfea597926999974eb0cf9
SHA1 6736e7886e848d41de098cd00b8279c9bc94d501
SHA512 f550af4e053d89eff45c0fb00bb32e8d212645a155727d3536a3f12bb0b5550bed25516516334245b912fa4fc2e4e7c267e80da4f06d22ea128f20eb56ab4351
SSDEEP 3072:zr8WDrCC7HN9fN8sFOE1Z5Y2966ilU9xL:PuGNr8stZ5/6Jl0B
TLSH
T1F8E38D21F5C188B2E67205B54D2AA79E902CF6340F3195E3F3E84E2D9D342C35F765A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64BITM~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
Size 278KB
SHA256 b8c5b99365f5ac318973b151fe3fe2a4ad12546371df69e1b7d749f7a4ce356f
MD5 823cb3e3a3de255bdb0d1f362f6f48ab
SHA1 9027969c2f7b427527b23cb7ab1a0abc1898b262
SHA512 0652b60e07aa5a469b9cf1013a1ed98d0352996c59b9a66f612be2bc0081d8ec8a65a44a3977d2e188cd8ee3311edb251b818cf300d152ed5f633679a6cf834c
SSDEEP 6144:PuZ1UKupTu8ffMb0/GxsZfcJtqQ1UBZ6g:XK+HMYcytZh
TLSH
T180546C1A77D84CF5E067C23DCD528642E2B278551B34D7CB6760026AAF637E0AE3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADOBEA~1.EXE

Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
Size 454KB
SHA256 f94ddaf929fb16d952b79c02e78439a10dd2faa78f7f66b7d52de2675e513103
MD5 961c73fd70b543a6a3c816649e5f8fce
SHA1 8dbdc7daeb83110638d192f65f6d014169e0a79b
SHA512 e5d97ee63b02abc65add41f6721514515b34fd79f7db23ae04cf608c2f7e0504e00b07694047b982d14d60cccf6f833b50268c693e3baf1b697d3370c0bba0b6
SSDEEP 6144:PuyQsSVWSLjX2PxPNMRyfn7LzPdKblt0K+HAfh0v8axsbQuXYvr6yIll6Jf:6VWnxlMSn7nFKbltn+Ch/m6Xl6l
TLSH
T142A47C1077D0C036F1B329768A7FE728546DB9715F6881CFE3881A6E4E706E0AA3571B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
Size 1.2MB
SHA256 57329b38314923c17e9dd9e153e894708389dd597fcb1438d5291c7627238653
MD5 e115eb174536d5fbcf5164232c89c25d
SHA1 5879354de61734962d39d13316d1fe028389cc16
SHA512 69696a2e842e0557a57ec4d12c31d5afde0cdfb80d6028ad8d9b0b59d558ad6eaf043c9da0d31c43b16b4f12894dcea69db9366772c49c758773e6c35a9fb0c5
SSDEEP 12288:Q0ZRHkXVfeeO4LMneqyQsWSjGQCfLBlS7guN1AnQ6i12NI+03Sgouvb:Q0ZRHkFfenxyQZXS7gZnQh2NIDSgouvb
TLSH
T1EA45E50267F94129F1F37B71EEB993645A77BC61AE39C50E5284025E0DB4A90EE31B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaureg.exe

Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
Size 555KB
SHA256 38b06ee250af6554e6740a1bb7acfb77b99ccdb8081880e01c386afa98668766
MD5 ead399a43035cf6544c96d014436fc9a
SHA1 c8ef64abb6c56cbd02e851a98214620459c8b947
SHA512 6fa46a36c17c9496c18843e04d78d5146cdea173a74acacd9b7c63d220c49fa3a1acb65f91fe7214a1ae82ebf63fb5366beecd7f9e0aeee0cbab5d1bd0aa6d14
SSDEEP 12288:TKv89GDYikjjqggz7/PtFxRNWBYrpkQJ7u:TKqjjg/PzNWyr9J7u
TLSH
T1B9C4BF2079A0C032D13311354D6AE794A63EF6700E7249E777D4AFBD7E345C1EB28AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOIN~1.EXE

Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
Size 121KB
SHA256 53e47df12f0ce2005f4a2a773d194c9431b325b64c205dfa4cfba45c973b65f3
MD5 6b27dd3f7c6898e7d1bcff73d6e29858
SHA1 55102c244643d43aeaf625145c6475e78dfbe9de
SHA512 52b7a596b07935f15f008c2de38c5dfd85df18b49e5083e363b90fb321d4f1bf588627dcbe94fa6434c460243b254c5ca1dbcf2c956e49baa92e13e104500f2f
SSDEEP 3072:zr8WDrCsPo10JOSdhuPlur1Vg9uCRFRzsxeZ:Pusg1MOc4iVmRFJs0Z
TLSH
T1ADC37D22F9E0C032D4A219B88DACD261593E7A721B358DC337A41BDDDDB13C1AA79357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
Size 325KB
SHA256 80de06ea5d221e21f765a96750f821aaaf8eee23bfd9d8cde265a8da11041c66
MD5 62976c65ded41b4f31c7f379c548e05c
SHA1 3827c414ad15cd67ea8635400002c4c79704250e
SHA512 ddf74814c7a54a258b7200310bd644547f3a831e373c8392dddedd08b3c1ca60e864fbe2007e68fabdcfe1e923d9207039bde42a09e0ec07d69694263057fcd7
SSDEEP 6144:PuGIbN5zFEjGkqkAJHyEzYV/PvyeWPZw22b:xIzzFEoS2cPvyeiZwbb
TLSH
T19E649E95B3901CF4EC67853ECC258916D6B27C2A0B70C65F13A8366A5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
Size 325KB
SHA256 d2f956514bc885fed054dec3ad4c0e89e59a6a38390fa8432abd15eb201468b4
MD5 de9e6086062f01926b48c2d80508d12b
SHA1 13610cca5e38925e22b6a79067df0dd9eca49fe3
SHA512 60478e55b6a3d49686ed8e95e939a2384fb1440950d710e7beedb9eda24be0e6996c931d0703d6cc0065fbe5a85eff463b9e9eaadf14746593abe723636137c3
SSDEEP 6144:PuGbWYoTOLHIsPPzAdnz0YutYPDvh2AHdwSc:xbWYoaLHF3z0z04PDvh2Cd9c
TLSH
T1D7649EA5B3901CF8EC67853ECC158916D6B27C2A0B70C65F13B8366A5F333911D2DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
Size 505KB
SHA256 97508a81b805937e1ca57711a51d2e8d715a2748e2f9d27d39dfecc28f3fb9e5
MD5 7aac73055860fcd079d9407cab08276d
SHA1 482b9f337d60270c95950353f9ca8929d8926b1d
SHA512 f183a10eb13c083c7cd8e785a7978eee4998c33d1eb104a0ab0e54146e10651f68612249e668baa08919a5840f6f929b5452c93f71a232b30aab9e2857109fb5
SSDEEP 6144:PuG7aKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvWTiYB2n5:xmWRdTfgwCHKy7GLbbdIvWTi4e5
TLSH
T107B43990F3E414F8F0B79A3589764511DAB67C6A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DISABL~1.EXE

Path C:\PROGRA~2\Google\Update\DISABL~1.EXE
Size 5.7MB
SHA256 21719f3b636ac9d9a8b5ae3f1b15faf10a5110d2d75e0e4ca8e681160642e6ee
MD5 c86cca2bfff1cd36226331a3d2b909f3
SHA1 c496cd48d6ee43e2cd0025c9739fa5c5b673e483
SHA512 c2a7a107a7ecf37b3eaad4fe7a899fb70aed3926daad7deb2101175998dd4b52d74972aec4e4023d618170cf70142d6d714ba1fe8fdb632d5839d4e94396fd6b
SSDEEP 98304:Nog5HQ+hDHQTW6Af4fF7KkOuYO6IgF+IAMk/JexMXP8iuHG9XXYXQz7w7:Nog1P9fIlOuz6IgF+I3m2MXP6HG8QzU
TLSH
T128567C23A4E08035E5F732756D2CA73959327BA29F3145CB86906C946FB83D3293936F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\BHO\ie_to_edge_stub.exe
Size 553KB
SHA256 ec0a475d423140079ccf795ac5c8671a1b4211d317f781afb85c17fa3f600225
MD5 f7277ce8e8804e0924729b9f505e9e85
SHA1 46c1f99aa41232b1f47c16f3d989988c3a0b2339
SHA512 0e87a17b0358334f10a07f2e16ef39a85b76299e007eee1de0cfaa711eda28b7c78bef3de4cedb98f3ff7b2156b8faade3cfbb641b9bedb6bede03c8b4d424da
SSDEEP 6144:PuD10k9mqI9PZJroJIxXY720DRaOOcno2m9XlqkuMnHvEU:m0k9mnRT0JIxQ4ObTMPj
TLSH
T19CC48C41B7E445F8E06AC5388E478242EA7278960F64E6DF02E4927D2F3B6E55F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookie_exporter.exe

Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\cookie_exporter.exe
Size 157KB
SHA256 ea8e043a8af5e2dfb2091844f70f5e1c7aae710a0645ea108a1db015b55e8df6
MD5 dc2b94f7e6c36bce9fd887aa00df6625
SHA1 fdad5e8022a6666f6dd9e63d6c9c17676600b9da
SHA512 ad08f80ef7413f423a5b4b8cee33b3e70862cd2ebe869af423bd5c01daa2d885bc4c2634498c7f0c618e5ff5bc34aa604ff35fb1f8394c1408078315c2a49e1a
SSDEEP 3072:zr8WDrCgLYCtagaZzAconl0ZAkvThvss5XU9fCYM1cs4qEm44c:PuGYCAoloFrU9fPM1lEuc
TLSH
T1A9F38C97B3E124F9E1724A78C8518A14EB77B8311B309BEF03A446891E277C5DD3EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\elevation_service.exe
Size 1.7MB
SHA256 a2523cc831659b237bcc32ca42b64fff36095f62b163c166f4b7e59100984a93
MD5 783fd5feb0b759c551e095a05f1c0cce
SHA1 49a76393317e26bf4347e7ed78fff4ecf4eba63b
SHA512 bf1fad178150128718d88f13b3b9c99b70fe9eec7314f04053c43eddff62c2850d267d540cd811e5dc9188e7c8ca9df8614793b840b107a3b75d0b9014dda2ba
SSDEEP 24576:iqASaa2tcUGm1zKdwI5N/OyNEDb5kD+pauvtuP3GmrceY9CUPKb7AAo4q:/WWu1zKeI5Nj2bcuBluP3GiynKDc
TLSH
T171857C03F6D901E8D06DC27887469132EA72BC4A0B35B6DF0690B6592F77AE46F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\identity_helper.exe
Size 1.2MB
SHA256 2f094ffd3985ee30b9ca280dcfff8f5c7e61db139fc3d2371e78be738450a666
MD5 b3d0bd1b4a0d78f778df79f83ddca8db
SHA1 fdca7c58610721917987a88f805a27a5815b7e82
SHA512 8daf2b4f40941a25a2ae441d494cb8cb5da5877678f835d47dfeb8a00a4dd25c5db17e41521891e3c6df67532af6d685bec3bbab2568c3cb94c2355a10cb2e83
SSDEEP 12288:8z5/oszT78I/xem0kzfdlslx+DpNeVP5ojRlP5cjVh6u+mshA+nkYo2RggBKkLUe:8z5/Pem0+dl6ZVP5ozP5IVJXyxRWa
TLSH
T185458D07B69941E8D02EC1B48B464176EA72BC550F34AADF0690B3592F7BEE42F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe
Size 562KB
SHA256 5ca66d0a92c97e353cbf7fc47246f2292fb9ec2966a4abf7a03ea4a8c8b406c5
MD5 0c8f4aa0275684523dde74fee4920251
SHA1 8fab34a8e99ca6dea524869d563f0d3103abc913
SHA512 b6927c6028964cbaba0d3f227e72d62989298d47a520ab6483e13582b831f69cd38f9e89c93e1f01254193fc76b324270204b41e67d628151093060b5b831434
SSDEEP 6144:PuJLO76tlVr1Il5HlrJHU7kfLeeHVlK8SQBJ9LBKJwgdAmKa5rl6C:gS86nHrUA9HVlK8SQBJ9t4f15rR
TLSH
T134C48E41F3D847F8E06AC534CE528646EA7278960B61A6DF03A0527A2F376E55F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe
Size 7.1MB
SHA256 bcea62bcf7ac1a58399565cb993ff0d74e60b117760c809a6f82d1c4f50e2d41
MD5 fb42b55c92d496631b61a583f41f6abf
SHA1 6b563f0f4e2cde2f8faff7031e045273118c8f73
SHA512 3f1fe5adf6812bfbdaaaad478f1b219b3e071687d1993177f571ade847de1f3e396b6bc20b1e113b49ecd31249513a4c76524fdf1d3946f292349c34435eff70
SSDEEP 98304:p6CZetahq+WZxcpwCsJB2++fGOOxRj2vJzRN+T6frL:0CZetaEMGIG5xVqzRdDL
TLSH
T1CA766C47E3E600A8E46ED970CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookie_exporter.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe
Size 155KB
SHA256 7fc13ee7e85761659331398585b2d5bf08ecaa65077e162f748b2b97dd0b9152
MD5 605433d3da1d4aa0ea1e479bd41e233b
SHA1 8c94717d34010132fc20f0b32faacfc76290cc87
SHA512 be1a5f58996e99948edfdba88527a9ccfca8a31ae0b5486c600f97ea1fa20979907987713365d26d2d7cea485e835918fd2978fa6e31d0795f11d4cfca739027
SSDEEP 3072:zr8WDrC2/5vndNI3Kk4+NLlzt4++++YdbeBGnRppeQBMWRywl9:Pu2hvndNIaINY++++YtBnRpAFWcwl9
TLSH
T1E5F37A57B2E870F9E1324A78C8118655EB37B8711B21AFEF07A0065A1F277C19E3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe
Size 3.8MB
SHA256 ffbd64f72a712f25934fae982a24bcf3f2be0ade3e54c4f606f0783722bb7d2f
MD5 be92ef0b2d8c87da493d292a37109ac7
SHA1 2e9ac67928d465f58cdb66e37a0a96d9cdf79c29
SHA512 86ccd8cf9967c822db9f37ed5a5b26e35865cbe3ee59d35b1075c4479ec114cabec73e4b1e4651d192310c3b066df4481149def9b33aa1900b947662fb8319ab
SSDEEP 49152:86gu3VyrBme/hqvxbmhLbKqm006NPpIupEoEVu+e6NqcXToRzvUqIzYHBigdQBW:h3mMsYvRmCCENUhIUBbF
TLSH
T128063903F29900E8E05DD578CB568122EAB2BC854B35B2DF0750B7562E7BEE4AB3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe
Size 2.2MB
SHA256 71fa2d5fb7c3da809fc0e66b5c8e989bad16b443d24487cf4508cde7e2d8397d
MD5 6f78469adb39a66ed9c209cd4e106248
SHA1 447ce9790eee0b78ff0ae18012083320ff70f61c
SHA512 9e642e3fe1f7059b213780df38d7e0afddfe39ddc2e6ffac1071c1693b8f3024b40e68a31dc49d2561511deac48598abd5a03ffa5ad7ad2088ba70659d35a4b2
SSDEEP 49152:Nb+632BuPkFKRrdE6oh2stBhuXjfS4LWxn9:T3q6DjBK
TLSH
T174B56B03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge.exe
Size 4.0MB
SHA256 a0bf37dcf76b6bcb0e1b4a13cb525ea70d88a2a8eac4f9b1c75f79c04b7e3b09
MD5 ac14500237b9c16e3a065ec1c8f46536
SHA1 70e7e1895dff7b255b6a40010af5c8b2938e6da6
SHA512 02a96adef93cc7ca7f2dbef767fe1fe73b37bc663e147b366883f82e6db47abca649e39621808cd7ac21e138c4215e006b9d16fc93336d49c74a00970d73ed59
SSDEEP 49152:SudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/BaK:OijnUdYd+RaAK
TLSH
T18B164903B29940D8D059C074CE5AD232EB617C8947F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe
Size 1.8MB
SHA256 dd17f95d51fc498b681629bf544553d67dbec4840265af2adcbec04d9ae70bdc
MD5 79c7a64fd941121c55a855aed3578545
SHA1 1f333d01450ef8fdc7c2280ee154d71b31127a14
SHA512 70ce1e8d86e15d02454a2c9de6ec4dfd5c620f214278745fc7ab6ba1fa886302370ea792a305815156973c71550efd0a120ec3d0dc742920f6008ae571a68353
SSDEEP 24576:d5kAGu6McqpA7D9ruO3O7Q7OBLLMdus7CtW7KSdHBxmRkkkkkkklQXBysWAk:dZGu6qG13O7Q7gLYduZrSdHBAVfk
TLSH
T108957C03F6DA80E5E05DC2B8CB768B35EA717C554F20A6DF0680BA652E77AD04B3D394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe
Size 3.4MB
SHA256 8d98bbaa8691268632b5276bbb6a77437d28d0701c5ff083a306deebc3447a82
MD5 43333fe46b98b08a67c2c9b5fa49217e
SHA1 4116c947ee02b8dbca9a285731d74d2e8e2bd0e0
SHA512 68d61bfe184face307a5a2783d81003d61a70ec6662f041f42ac65c913a549a5c7a0c28741211b58200f696c1638f8e3297b24904e5568e8ff3043b18424677b
SSDEEP 49152:7uZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZCLlrrW:No/Yhy8OnZ9
TLSH
T149F54903A29900D8D059D074CF4A9232EBA27C8D47F566EF3690B6D52A77EE47B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_click_helper.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_click_helper.exe
Size 1.6MB
SHA256 dfca94b2e75cd8f292a3ee853ca77083dfdd196e7dbc2f52f80f59e77716d87b
MD5 d5eaaac3090f4531f6373f2531844bbc
SHA1 cd48b620ca8d9df375682a44b233216c7c913a60
SHA512 967e52b87476c663cceae9f1e48494ac5453788db3a579b6379b49b7611502a7b3bbd27eb5bd9373ed43bfc608e78beeb4fca7952b751dde3b84138fe8ffe573
SSDEEP 24576:lnh1d46If99L9KA4uaiXJVB6HveuTJb9HxeQuJXlPnyF4mfHU9YawsNk:r4hoNiZVB6PeuT5lxeHX04mfHIk
TLSH
T115856903F2D841E8D06DD2B8CB568122EAB27C450B34A6DF0791B65A1F7BEE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSEDGE~1.EXE

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE
Size 1.5MB
SHA256 d6a52fc33703813fe2e2a549aa212fa07900d6677aece66832ae294b1f04f51a
MD5 d1eb444ea326ecd35269caf916a3ca18
SHA1 e0cd3344856df55fe7659607d5d896cfd9dee7f2
SHA512 97c53807e9e2a4466ac1ee10c04e5952c492d34e987d024ac1e3e4a04040a41b48877d02a9c34b530f542be5b30e5653bb87b74f2a53d158004a78555f154065
SSDEEP 24576:vyoteh6euUHmEhK7eTuNdfxINakEtv9kWG2L1oaedpEukUoygGmq/SJ:vfehjvHHKTdfxINPEt99G2Bo7EukU16
TLSH
T1CB657B03F2D801E8D069D1B8CB568536E9B2BC450B24AAEF0B90B6551F7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PWAHEL~1.EXE

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE
Size 1.4MB
SHA256 6d3f80c24e7f9f0b5d8ecaa6f54c4f047578b8deef5f5dd71748074c3bd68ea0
MD5 5ca37bb2b18dca7e9acd873a7d1c92e1
SHA1 b84f995b18056dbe76fe21a7fd49e4a803185f3b
SHA512 8a902fbe4ef9cd94763a388f9181a26eb0082d47c950bbbccea3a70ff72c887734a6d96c6c53f3b733d27881bbbdee13dcd86ead64fec51ce25415f36afb621e
SSDEEP 24576:CZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27d3WlE:ZY2fF8FhmS86IUJWQn+6h27d/
TLSH
T17C657C03F29940E8D059D1B8CB56853AEAB27C450B34A6EF0B90B7552F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 1.4MB
SHA256 2feba86fd7ed5264c069f66397b7f08d8f245233c0c7a8be563e6f9846f0723f
MD5 ea636cca5b3700ccad74fa547bee1620
SHA1 52b0c4fbbe2776d53d3c53236a931a2f66327af8
SHA512 78b413ad1078cd6a8d5c5a9c063c71cba9aabf722a25ab824dfd94b94d590eba44ac2db5d782a34259b333ca939c58290616133b78775d972c00044d69b7f809
SSDEEP 24576:UmjDvw6qZ04SuTjPn68TQuD3g9gZLfChjyosZ9HT1zYeHNrk9NrfZ3:9DvwZ2XuTjPb33g9gZLfCdW9HTlXrk9T
TLSH
T14D657B03F29900E9D059D1B8C7568536EAB2BC450B34A6EF0B90B6552F3BFE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 233c07bfff48b5fbad30cd7d90579abd0886400017cd6e7fb037e5626abb1a4d
MD5 71fa6328268340b183c55defa643c474
SHA1 7c004defb21dc2981b3091495c900e02b34e3a86
SHA512 e5b634d358633981cd343c3da26ee18738fb6c54b2334814637e0a9a45343d14770fed7a09c63d55dd190bf7ef111664ba5872f5d5ce925e6bee783e166c75b7
TLSH
T1D4D080F437A5F505C786617357D0574173650872101647095151D02CCC645DD63DB1DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2fd9384e79508a77111bb6310e9414898358885ca508610502ff6f1a15ad704f
MD5 714e68787bb5a6d2fd82139f833a5d0d
SHA1 f7a22adc92641d05515b3ae096da910924f11c1a
SHA512 b133f27abfa4ed5bdbd3eaf997e0664f0627537d4882fdaa63c0b1b301219d07f8ba46857db9a196b1210c29ed9f79e6cfd8c688d502b118a21640805665f762
TLSH
T16DD080F43795F605C786617357D0574173750872241647095051D01CCC645DD63DB1EF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a03f48c915ab51afb8a3060a43d2e5b42d6308dafb3df80be0c4602774d32bb0
MD5 f6cf53925017b013d2f1fa6a2269db58
SHA1 8d2a3c941707074d355fa7a2f4c0992b9036e0c1
SHA512 3f0df5b338eec4314a65b6d38400aa2e2f10d8748d982b432b8ba00a250eba42300286a07c9ac1fbae91d1f14e855b40caccc6d3751f4ecc90721935be80da82
TLSH
T1D58199351AAF0575CF9788F9C657EE695BB3A1823003A71B4326437CDE8B697F092520
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59773a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59773a.TMP
Size 3KB
SHA256 b0ac03a2640f74c978e9bd94427fc8fc2413071869a9b0f223ac81cc5c5016eb
MD5 3d5a6c81e44641bb2b29236b087a7acc
SHA1 bedea6c106b9e83601b76ad9b4c28d508e7aa25f
SHA512 4b45fb7bbc76004b8c3ca6ba301d44d24a60525d473cab8d813c22aba5e762dca2c497872188f44c76b4b99ef0b0e551afb3843cd79fc8aaf285b03d5911ddd4
TLSH
T1D6712B3A237F599AC72701BA56DBDC893F72B0937507AE28437590785F9FB04F062061
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 378a8bc6f76e5cbcae250a9f5fbb34e09cd382a29d19042e1dec64505e586474
MD5 f8e2d64aff922cd5118f2c78fbf70f4b
SHA1 3a277cb8c8dfeeb929636edc47e41eee8a45fd67
SHA512 2190da6b8be59cefac03fba7c810beb8c49bd0ff8f2bcad537668b35dc0a63318b1b40ff35df886e618ee604bb2e2f713a8d04abd1fdea8e62c333c86bf0fff4
SSDEEP 96:DlBOPDHjQFahafjh9zBGO5cwmiHztQ6tgbx:DyPDHjWahafjh9175cniTtQ6tgbx
TLSH
T18DA1DCF3C7E5862DCE0195F0AA146F1FCE190556436C3D5A89E4AF0BA3F24B1E151B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 0d056a0adf16dcada605a3f32824e143d3763dab923303a8d2edfe692b3119a5
MD5 339e47770481938823ce3513034ea481
SHA1 fafc3c58905e05c0bd219b968db3094aebc452af
SHA512 543c68afbb96ba6151fc1072c89447767a80cecbdc753bfe2ed20a48982d7f693475e8d3184fddaee4507f8fd40adab95c86a6246b93bf481c490f972f086af1
SSDEEP 48:YALlNbBOCD4CDiCDmgypCsuaAsJfo7CZszjhhnONzsLzBCnOCKC+sjC7wEsagmgw:DlBOPDHAahafjh9zBGO5iGwmiHl/tQVx
TLSH
T18E91BBF7C7E5862DCE0196F0AA146F1FCE280555436C3D5A89E4AF0BA3F2871E141A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 691d94f1c76dfcace13edab7454b8feade06170d0462811b86e67a8fd1bf91bf
MD5 ec097baaea325d05aea6e43399fc8ca4
SHA1 3e093b603401d9109c883171e4f021c53aa4a5e2
SHA512 4416388ad2560391ea14af5f3eb87ed67457b9a34abd2eb1aec902c4b36d3e5b1cbca889ce780704d7c152d8dcb4b7e36e68e1db76743ba1ef41fde2d417de19
SSDEEP 192:sxRVeS2mRIMyM/jK1Ml8wHYt/fHQsYj6NtydfCrJH6qbRQEFboA8pJV3/g6+WNPk:sxRT3xy/fwsaMY4KEMH/5L/ghj
TLSH
T12072091669284D3B8CDBD258FA51BF53D6F91073E2944E48AAFCCA0C05E76DD221382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 241c289ffb4b7843d8235c302be48747b35469e7a6ae956427cc32d9ac5b5d4b
MD5 de8ca63a87e69c95ca6c9fea071a59c6
SHA1 3960164d9d424d3eb55d607d022ca1eeb46e13c4
SHA512 6a9fb5992a8581e30f10d514f7676c24ded1e6787271607b793fe7ed539d70ce8d7afd89ce9b390264669232b59883bf4b74f6c93665d98d645af9e67a82656e
SSDEEP 192:sxRVe52mRIMyM/jK1Ml8wHYt/fHQsH6NtydfCrJH6qbRQEFboA8pJV3/g6+WNPVA:sxR83xy/fwsHMY4KEMH/5L/ghv
TLSH
T1E072F91669284D3B8CDBD258FA51BF53D6F91473E2944E48AAFCCA0C05E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 ba693ffbdac812bb627be65fdee0e6d92b0e2727eb99b51674b8417d2920df6f
MD5 a83a3d92087a1f95a3b87e6eb066fe7f
SHA1 9d60d93041629e068688efd2d8d8b2b6e0a0a0fc
SHA512 b523d0cacf05cfd6c5037d68e572be02b6001b62fb9fbcbb9af514a74ac89420d151a5a8f26b9f192ce0e333ccb6a1e7330bcdaceb9b4bd3258b15c87f6f58b4
SSDEEP 192:sxRVeS2mRIMyM/jK1Ml8UQYYHYt/fHQsYj6KPty0ZZ77qNtH6qbRQEFboA8pXV3n:sxRT3qny/fwsalYKVbEMd/5L/thN
TLSH
T181720A16A9244D7BCCDBD258FA51BF53D6F91473E2841E48AAFCCA0C05E76DD221382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 806970bc2c8e8bfdab2f180877bd4482fd0ac0627352c1f5f85d51736e441722
MD5 43eba7ead8e679e18eb1a973533254c5
SHA1 a13e09b9b6306397cdef5d8246e108468980a526
SHA512 351f17eda38e157158178d88464a43124e8d974b65fa49400373d25ee5778c3c724172088272b2427b40185c963d86f8fd69d49b40eed3add62d513d09a8ab6b
SSDEEP 768:AIox/O7pLuL7p0WguMfnA8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6cciJro5sl8V:AIox/OE7p0WguMfnAu1jaxXii5sY
TLSH
T125E2EB3B680CCB7F4F8449DCAC29BE8A6DA801CB56D8CD9447FA851C03C66EF551A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\09221457-c163-44be-aefa-3784dc0f5726\index-dir\the-real-index
Size 72B
SHA256 f269e10a2471b17e095e4083d2309289e50e2f9346a78a5b26b7f1bdb96aac85
MD5 122c51f8a10bb7a93d72fc6de9447ac5
SHA1 55d4cc9ead245ff60673936586b99db4651e6f57
SHA512 a3c09d08b1058fd9fabc95395e48b0bd9823636695fd8a29ce4b36f8a0c5c58e470606d2e5f422176e3ef6a5db1a3d09a688ba2dee8a3244b096f1bb42e656ce
TLSH
T1BFA0021512C58702C01652F0AB97D15573D06A2012071B0E72D00045C9615DE475255C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\09221457-c163-44be-aefa-3784dc0f5726\index-dir\the-real-index
Size 72B
SHA256 c33fff13f444f53dec9d713ac9298845dbdf38024fa2ddf3733e62d2dbc55ae1
MD5 e001be20a8f74e9be4aad163c36a43a9
SHA1 f63844d2d71698cc9e62f1be91a4c575d8e8c86a
SHA512 a240be1420830cc882d8ac08f155624732111a51b575076cba871af3636cbb04554079b7fa050fcbc5cca6c76474e047f639c08f4c24bc472567f86620b31236
TLSH
T13AA0022047C5000BCC1751B116D212661600C914F944120640915344CC944A0494708C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7810cd6c-c4d3-4ed8-a03b-461d0290a487\index-dir\the-real-index
Size 696B
SHA256 73a2f52884b1c5324a86a4c064deb024de7f0c083b3d3759cb4e93859cb6bb3c
MD5 ee6a8183abf5d9b4e62eeb856c5ca147
SHA1 f00f16d4ceb87e40165f30fbd7392c39e5ba2212
SHA512 fc64c922f12ffd7a12745889d2d97f9213f01754eb0240f6c6f8be617adb2823a97bed4f89b5de00d42b3ee3f7a7f6bd7f2ca5423fdff330ccdd5662b19b35cd
TLSH
T16801C0E18CC21803EE1692B31935A00C33B625FD32449A07206CB53D4A136682510284
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7810cd6c-c4d3-4ed8-a03b-461d0290a487\index-dir\the-real-index
Size 3KB
SHA256 716b5f83cad70e297710b697cf302d6f84c02770ccee846cdc19ce20eef21fe9
MD5 6137390f77e8a324b2171c183ebb5e7c
SHA1 b33256cc927cdc577577ef5e786c3f19a6ae2059
SHA512 811f525d93a214ca6983f972ac5eb700de751ae92f9823c64938e43ce9145fd785723126ba5f88823905f1c010777c7ca19e4b581e0a518d534c16143c2a857a
TLSH
T1EE51D84ECC86295EDDAC1D7368F9048933393DEE5B49CA0B26BD62397DC323E1C14159
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f076.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7810cd6c-c4d3-4ed8-a03b-461d0290a487\index-dir\the-real-index~RFe58f076.TMP
Size 696B
SHA256 656bbcac39fee8ff0dae31892907f60d4bff2c6d183e8a3362bfaf2ef117a92c
MD5 d3b8a09d4ff454e16a51fe7d031792ad
SHA1 bfb274a12579f8dc58492168b8b8b7af8e64b44f
SHA512 69f9fa1adcb46bd3146231e4c552f261377cd790f0b7d4a0717a6075d26280e5fffc769d23d3d9f7c0a127f2274a571156184fe82ddfaa9b798eab6faa9ab4c4
TLSH
T1B0019EE545D15D43DE01D5F72B07651E32B754303344AE0720F9B07E4573B296155289
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 cfefbad7b034e9b7af4edcd3ab62208386c41f64ab9a37f0ec761b93e0ce99f3
MD5 5214c0eadd0e5f1ffa4688ce23a65aa0
SHA1 bb130a892633133cf27ed2901f5722a424d609be
SHA512 a23437ab2fcd32734fd34865f3a3f9a0c6b5c8234f2f20dd5c1bf91c122a5f0b979609640d3c545990222937bd9e8308e52f792416e94e273027b47bd306ca94
TLSH
T127E0D8B719F61828E85FCBDA3871D4A5418579649645AC4E501F92C350BA3553499C12
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 25767787415b253b76b7073e01c810d18ee122cb3b0b0943f5863d21da617433
MD5 795a065b202a2dac119212f4b0f8d9ff
SHA1 7c0a1b353049a56bedd41fb735d5ade167c89008
SHA512 9e48c43599328dea3054e54f94fc9e7e1aa11a9d177bbee0da84519fcb6d27f8feeff89e316fe94cf479f61c7aff2d4b26d0fafab0e08c4fadef75ac52c4eb0a
TLSH
T1C4A002E6E1DA0E41E21027B2F14901877210CC14461A271383AD0154E8AA1814922148
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594760.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe594760.TMP
Size 48B
SHA256 1b5c28b6326cd6b6637d70f2bfd0499907034c492221e93b4937e2fde44be614
MD5 bb75ca21dd6b923d6eab15876170dc48
SHA1 b376e3891f0f3d53e1ea0717961a765dadcef569
SHA512 475fff031ea12ec0a54e3985590a43fd947e2507df70b2d8bd932bee5a28d7d255aaf0f10344fa82292cf057df477a48cc633674eebe0812bcc71d3c885eef93
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fe7c38f7def3230ab8c92aebd5f6dd49b2aec1663d6ec313bb79057a377e56ca
MD5 c43b7fcf0a3e308089d27ee6d620a48d
SHA1 bb190f8bc82bf9b7d4c6e27afa7a20c0ca3eb923
SHA512 3941a0c0cabf7662b12f715c3708895e32e1e9140606b482ae816cd4a2230f64e1bcfb071c2d844e5609a062793ce447228516d6ea93e2b9a6e8a07372d52a8e
SSDEEP 48:KonIpKUgETyNNIxKG0szydtIJK+ksjklQUu3:KonyKUgquNuKG0y+t2K+k2klQUu3
TLSH
T14D91A052B3771B00387E36198778945F5283307274DA792E3BA921E62B26F054EFDBC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0f127d3-512f-42f8-94c9-c00ff4b4d441.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b0f127d3-512f-42f8-94c9-c00ff4b4d441.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 94a865574d85bfb7e42999adfe80998b36f52b509db60d888c1a105e04f180ba
MD5 d31e5c09b3751560c8e06dacdac92261
SHA1 b291ed540f6d76d79fb8e23e65a516d35ea363ed
SHA512 4533017ac2c85bc52a70be0f1b276b250a3762e692e6328e1cacf87f524b9b6a928f81a9f83e8f609ab4949b35d0fe035b30f791b9bb586a7f315e51910872c5
SSDEEP 768:9rv+4UNbdF3SAvQOJIt6K/hUAFjQIMyOV3N5E9MOu+8r0mL:9bsbf3VehNFUIpONNmaDrv
TLSH
T13603BF31E8A8DAB39CE7A7C5760A72437FF441A795C10B84C9DE2B0D824B5DD231BC62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 66a1f09b80f040747a0374daaf5d59c5e0c0e176ee0bde1dbe8bed6104c9db73
MD5 30b58f618db738c1023996d5fe328a8e
SHA1 19f9f742d907939f8d1631066413bc9b49011bf9
SHA512 b33f74d5eaacd2779115b8314324ef58413934d62edcae2cc713d1520a821c0595feaff61a48ba3ca76bb00d908fd569aad58af5f33214f85d179d42c69d457b
SSDEEP 768:vj+9r32qZzQOJIt6kf/hUAFjQIMyOV3N5E9EYeG18KzHQ:C9r3RGhNFUIpONNmp1tzHQ
TLSH
T180F2BE72BCA1CBA75CE793C477063353AFF4426796861E4089DE2B0C468729D134BD3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 fa96e5a701d82146722456aa5d099296e683790fbc234e3403ce227cacc67aa7
MD5 36e29f44bc0684db8753a6f29970e5cc
SHA1 f606b8b8509484bf7a6d47a516ec60bc31e3696d
SHA512 78298f1ee5f548bddb665cc9d991d21363e596e4fc5dbb921132c379c0a48e8b1e509d12946bacb25e037ea8eda18080dd7e1137e0c3276f826240ae1c928275
SSDEEP 768:hF1j+9W3Cwg1qZyrOJIt6kTQ/hUAFjQIMyOV3N5E9EYeG18KzHQ:g9W3FYAhNFUIpONNmp1tzHQ
TLSH
T1F8038D76ECA1CBABACE397C5B7057647AFE1426386896DC0DADD2E0C01872DD034BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ff64006d808110363d500a0066716d4d31a2b6be903edc1d9e65df6430efbf22
MD5 95f9ab0a9cd7fd4922278543a7e6ce62
SHA1 6448b05fc0acc31fe9124013754ea4b638f7d719
SHA512 51b146b52182925d275fa41cbde5304968a56108ccc5a499f6a67ba27ba559ca6cc056a8c7e9415da2695fc935af8de577cb71df83d1eff744b5c69dbcbc394b
SSDEEP 768:Srv+4UNbdF3xqZzQOJIt6kd/hUAFjQIMyOV3N5E9EYeGUK:Sbsbf32ehNFUIpONNmpUK
TLSH
T1FC03BE32B8A4DBB75CE7A2C5760A72437FB4116785C60A84C9EE6B0D468B1DE130BD36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

0ea42754-ba68-4bf9-ad55-dfa1cd322ba4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0ea42754-ba68-4bf9-ad55-dfa1cd322ba4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-06-30_fadbeca908fa2ffbd3e49ee0cc5a4809_cobalt-strike_elex_glassworm_icedid_njrat.exe
Size 5.1MB
SHA256 ff4f760bb826d81922f314c0912c009ee25b88330feb75c9efafb089a5cfef58
MD5 5b9ec05572b4907d1ad8457c96a1483c
SHA1 32536b8e2dde76034804478885ed102b78b035ac
SHA512 761cfaa58f140988c3692f28dc0d898b0917aeff87b0f0daad442987b9031f575338b51891be1d01ed11da217b43d6986839a1283f229c2dc91799ea9a774ce9
SSDEEP 49152:C7EY75Vhj9As9UVrdxGD9KKqZDTltew1fqeNTwanpSkU0ZfbZa2jVQMRVrJzVoLJ:m74YKRrS4hRQI6Jy4Xhv
TLSH
T179366D03F2EA41D8E0BAD6758BB68232EA76BC454B34A2DF065036151E75FE49F3C712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\identity_helper.exe
Size 1.4MB
SHA256 4cd3e95e38df0cfb094ceedc26a43312d71f71e1361b3f8498f4996fdef2c73a
MD5 e9eff67e5bcb8b27e3109516d470fc56
SHA1 56a3e9b944260a05f25eacf55ac49af1aadf55b3
SHA512 85832d93f4354a63e39428f7cd80413aa5b094fbb933f84a2f5bcbe8e971b6fe9b38aab0013860d4fc061a769e5c29ff7fb4b488446b7a7984afddc8affa624a
SSDEEP 24576:JmjDvw6qZ04SuTjPn68TQuD3g9gZLfChjyosZ9HT1zYeHNrk9NrfZB:KDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9l
TLSH
T126656B03F29900E9D059D1B8C7568536EAB2BC450B34A6EF0B90B6552F3BFE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe
Size 7.0MB
SHA256 26cb956ab6e70438d9e2d82ded0db3294148ae689d2a1e29d3d1eee7b90b87e0
MD5 79739842d0875865064b6f3880b7f04b
SHA1 f2b4f9e8c53359ea6fccd3d883ea4b57d4d1ff87
SHA512 e06d24e4ce83afbde9406fa612a4955ffca1b5b486cd7777f280280bf439b6833fd3f4ca51ed3ef0792bb4ca3d83ad659ca856905d6fdd1614f5b7c9f9f3d4e1
SSDEEP 98304:r6CZetahq+WZxcpwCsJB2++fGOOxRj2vJzRN+T6frX:uCZetaEMGIG5xVqzRdDX
TLSH
T153766C47E3E600A8E46ED970CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir904_674877678\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

directx.sys

Path C:\Windows\directx.sys
Size 54B
SHA256 92b0ff861c5e878db40272c1c8bcb96a18741590f4681d7ba628f07ec596a7b4
MD5 caebe60046472fd243097b00afbcd4b5
SHA1 6c212890aef76796310957521924b4db98b9fd2f
SHA512 ac3554112ea2aec95e5b451672d3c59203d7f5829a2763194521b74f60c6ae7ea84ec99951aec4e67e4719e03a61df335ed19b7243155caa38083e91e37793f2
TLSH
T18990020485C78629059451570ABA624DD8A1085C3E4967504651A518114180AAE81201
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.com

Path C:\Windows\svchost.com
Size 40KB
SHA256 12b1b96cab03243f9876168d9fe528462a92fbbb564c1031876c0255555d78f5
MD5 80a4ab9a0121b06e1c0b24a6ad38f21c
SHA1 2d8a6d29f84c6373acc4f7835c7313690a5ddf6b
SHA512 86668462cad64dc91a1e0b333856da2117941e31eaa13962a0adba3613240a68b7fe6d26edcd9504d4e6953584665c63b01f125daabdc7e94be4e19d7d12149a
SSDEEP 768:nyxqjQl/EMQt4Oei7RwsHxKANM0nDhlzOQdJ:yxqjQ+P04wsZLnDrC
TLSH
T111130A91FDADC8B1C02019BCCF1A8FF4943A3D22B92516A3A7B53DBEEC79781580D549
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1184-428-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1976-874-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4300-884-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5892-804-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5892-944-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5892-489-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5892-981-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5892-851-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5988-977-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5988-848-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5988-796-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5988-979-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5988-943-0x0000000000400000-0x000000000041B000-memory.dmp

Download